WidgetListResource.post() raises unhandled KeyError (500) when visualization_id is omitted for text widgets

Issue Summary

POST /api/widgets raises an unhandled KeyError (surfaced as HTTP 500) when the request body omits the visualization_id key — which is the natural shape for a text-only widget, since that field doesn't apply to text widgets.

Steps to Reproduce

1. POST /api/widgets with {"dashboard_id": <id>, "width": 1, "text": "hello"} (no visualization_id key) → 500 Internal Server Error.
2. Same request with "visualization_id": null added → 201, text widget created successfully.

Why this is a bug: in redash/handlers/widgets.py, WidgetListResource.post() pops id with a fallback default but pops visualization_id with none:

widget_properties.pop("id", None)                              # safe
visualization_id = widget_properties.pop("visualization_id")   # unsafe: no default

visualization_id is documented as optional ("The ID of the visualization to put in this widget"), so any client that omits the key entirely — rather than sending it explicitly as null — hits an unhandled KeyError before the if visualization_id: branch is ever reached. I expected a validation error or successful text-widget creation, not a 500.

Suggested one-line fix: widget_properties.pop("visualization_id", None).

Found while debugging a client (@suthio/redash-mcp) that omitted the key for text widgets — see suthio/redash-mcp#99 / suthio/redash-mcp#100 for the client-side writeup and patch. That client now always sends an explicit null, but this is a server-side robustness gap independent of any specific client, and I'd expect other API consumers to hit it the same way.

Technical details:

• Redash Version: 25.8.0 (67a95e9d)
• Browser/OS: N/A — server-side REST API bug (POST /api/widgets), not browser-specific
• How did you install Redash: N/A (not disclosing internal deployment details)